ISO/IEC 42001
Responsible AI you can prove
ISO 42001 is the first certifiable international standard for AI management systems. We help you govern AI responsibly and show customers and regulators that you do.
At a glance
TypeCertification
Issued byAccredited certification body
Best forCompanies building or using AI
Typical readiness4–7 months; faster with an ISMS
Overview
What it is
ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS): policies, roles, risk and impact assessments, and controls across the AI system lifecycle.
It uses the same management-system structure as ISO 27001, so organizations with an ISMS can integrate the two. It also complements frameworks such as the NIST AI Risk Management Framework and supports readiness for the EU AI Act.
You need this if…
- You build or deploy AI and customers ask how you govern it
- Enterprise buyers send AI-specific security and ethics questionnaires
- You are preparing for the EU AI Act or similar regulation
- You want to stand out as a trustworthy AI provider
The Lightwork Method
How we get you there
01
AI inventory
Identify the AI systems you develop, provide or use.
02
Scope & policy
Define AIMS scope, AI policy and roles.
03
Risk & impact assessment
Assess AI risks and impacts on individuals and society.
04
Controls
Implement Annex A controls across data, models and lifecycle.
05
Internal audit
Verify the AIMS works before certification.
06
Certification support
Support through the certification body audits.
Deliverables
What you walk away with
- AI system inventory
- AI policy and governance structure
- AI risk assessment and AI impact assessment
- Statement of Applicability for Annex A controls
- Lifecycle, data and model governance procedures
- Mapping to NIST AI RMF and the EU AI Act
Timeline & pricing
Our fee is a fixed price for a fixed scope. The certification body’s fee is separate. Contact us for a fixed-price proposal.
Most organizations are ready for certification in 4–7 months, and sooner if they already operate an ISMS.
We often run ISO 42001 alongside ISO 27001 as one integrated program.
Is ISO 42001 only for AI developers?
No. It applies to organizations that develop, provide or use AI systems.
Can we combine it with ISO 27001?
Yes. Both follow the same management-system structure, so many requirements can be met once.
Does ISO 42001 make us EU AI Act compliant?
Not by itself, but it builds much of the governance, risk management and documentation the Act expects.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.